Re: Increase in Sun RPC Scans

From: Mike Fetherston (mike_fetherstonat_private)
Date: Thu Apr 19 2001 - 05:47:45 PDT

Next message: Alfred Huger: "Re: Increase in RPC Port scans (portmap probes) (fwd)"

Previous message: Vitaly Osipov: "Re: 31337 udp, on cisco...?"
In reply to: Jason Lewis: "Increase in Sun RPC Scans"
Next in thread: Rick Robinson: "Re: Increase in Sun RPC Scans"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

I've been seeing a significant rise in TCP53(dns), TCP111(rpc), and
TCP515(lpd).  My firewall statistics show that i've had close to a double in
offending IPs in the last month.

Mike Fetherston.

----- Original Message -----
From: "Jason Lewis" <jlewisat_private>
To: <INCIDENTSat_private>
Sent: Wednesday, April 18, 2001 11:28 PM
Subject: Increase in Sun RPC Scans


> Anyone else seeing an increase in SunRPC (port 111) scans?  Several
networks
> I manage are getting scanned from lots of different hosts.
>
> The scans are random IP's on the same subnet, I guess to evade IDS?
>
> Jason Lewis
> http://www.rivalpath.com
> "All you can do is manage the risks. There is no security."
>

Next message: Alfred Huger: "Re: Increase in RPC Port scans (portmap probes) (fwd)"
Previous message: Vitaly Osipov: "Re: 31337 udp, on cisco...?"
In reply to: Jason Lewis: "Increase in Sun RPC Scans"
Next in thread: Rick Robinson: "Re: Increase in Sun RPC Scans"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Thu Apr 19 2001 - 08:25:09 PDT